Privacy Notice — patricknewnham.com

Last updated 9 Nov 2026 · @Patrick Newnham

I'm Patrick Newnham, a photographer based on Exmoor, working as a sole trader. This notice explains what personal information I collect about clients, the people I photograph and visitors to this website; why I collect it; who sees it; how long I keep it; and what your rights are. It's written in plain English on purpose. If anything is unclear, email me.

Who is responsible for your information

I am the "controller" of the personal information described in this notice, which means I decide how and why it is used.

Patrick Newnham (sole trader)

Email: info@patricknewnham.com

Post: Leigh Cottage, Exton, Somerset TA22 9LD

Data protection fee registration number: [to be added once registered with the Information Commission]

Email is the quickest way to reach me about anything in this notice. I am not required to appoint a Data Protection Officer and have not done so.

Who this notice covers

This notice applies to anyone whose personal information I handle through my photography work:

• Clients and prospective clients — families and individuals, and the estates, businesses and brands that commission work, including their staff who deal with me

• People who appear in photographs — including children, family members, estate staff, guests, and people who appear incidentally at an event or on location

• Visitors to this website, and anyone who subscribes to my newsletter

• Suppliers, collaborators and other business contacts

It covers patricknewnham.com and the photography I carry out under my own name.

Information I collect

What I hold depends on how you deal with me. It may include:

• Contact details — your name, email address and phone number, and a postal address when I am delivering prints or albums

• Enquiry and booking details — what you would like photographed, where and when, who will be involved (including children's first names and ages), and any practical requirements such as access or timing

• Planning information you choose to share — anything that helps me do the job well, such as a family situation, a pregnancy, accessibility needs or a nervous dog. See Sensitive information below

• Photographs and video — images in which people can be identified, together with dates, locations, captions and technical file information

• Commercial and licensing details — briefs, contracts, image licences, quotes and invoices

• Payment records — you pay by bank transfer, so your name and payment reference appear on my bank statements. I never receive your card or account details

• Correspondence — emails, messages and notes of our calls and meetings

• Website and newsletter data — your email address if you subscribe, and technical information from visits to the site (IP address, browser and device type, pages viewed and how you reached the site), collected by Squarespace and through cookies. See Cookies below

• Shop orders — if you buy anything through this website, Squarespace passes me your name, delivery address and order details. Payment is handled by the payment provider and I never see full card numbers

I only ask for what I need to do the work and run the business.

Where the information comes from

• Directly from you — by email, phone, in person, through this website, or when you subscribe to the newsletter

• From someone arranging photography on your behalf — a partner or family member, an employer, an estate office, a brand or an agency

• Created by me during the work — the photographs themselves, plus my planning notes

• Automatically when you visit the website — see Cookies below

Occasionally I use a drone for landscape and estate work. I fly within Civil Aviation Authority rules and do not set out to capture identifiable people from the air. Where someone is identifiable in drone footage, this notice applies in the same way.

How I use information, and the legal basis for each use

UK data protection law requires a lawful basis for every use of personal information. These are mine:

What I do

Legal basis

Reply to enquiries, discuss and quote for work

Steps taken at your request before a contract; my legitimate interest in running the business

Plan, carry out and deliver commissioned photography, including online galleries, prints and albums

Performance of my contract with you

Photograph people who are not my client — children, family members, estate staff, guests, people at an event

Legitimate interests: producing the work my client has commissioned, balanced against the reasonable expectations of the people photographed

Keep a long-term archive of my work

Legitimate interests: the archive is my body of work, I own the copyright, and clients ask for images years later

Use selected images in my portfolio, on this website, on social media, in competitions, exhibitions and printed promotion

Legitimate interests, set out in my booking terms, with a right to object at any time. For children, the same basis, with parents and guardians able to opt out at any time — see Children

Invoicing, accounts and tax records

Contract; legal obligation (HMRC record-keeping)

Send newsletters and occasional marketing emails

Consent when you sign up; for existing clients, legitimate interests with an opt-out in every email

Run, secure and improve this website

Legitimate interests; cookies as described under Cookies

Handle queries, complaints and legal claims, and protect my legal rights

Legitimate interests; legal obligation

Respond to lawful requests from public authorities

Legal obligation

Where I rely on legitimate interests, I have considered whether the use is something you would reasonably expect and whether it could cause you harm. Information collected for one purpose is not reused for something unrelated without telling you first.

Sensitive information

Some of what I handle counts as "special category" information under UK law — for example a health condition or disability you tell me about so I can plan a shoot, a pregnancy, or religious belief shown by photographing a christening, blessing or other ceremony.

I do not ask for this kind of information unless it is useful for the work, and I do not record more than I need. Where you tell me something like this to help with planning, I rely on your explicit consent, which you can withdraw at any time by emailing me. Where photographs of a ceremony or similar event reveal such information, I rely on the agreement of the client who commissioned the work and, for public events, on the fact that those taking part have made it public.

I never use this information for anything beyond the photography itself, and I do not try to infer anything about people from how they appear in images.

Portfolio, website and social media use of photographs

Showing a small selection of images from each shoot is part of how I work, and it is included in my standard booking terms. It means I may use selected images on this website, on my Instagram and other social media, in competitions and exhibitions, in printed material, and when showing prospective clients what I do.

You can object to this use, before or after the shoot, by telling me in person, by email or in the booking paperwork. Where you do, I will stop using the images and remove them from my website and social media within a reasonable time. I cannot recall printed material already produced, or copies other people have made from a public post.

For brand, estate and commercial work, my use of images is governed by the contract.

Children

Much of my family work involves children. The adult who books the shoot gives me the information I need about them, and children's first names and ages are used only for planning and for captioning your gallery.

Images of children may be used in my portfolio and on social media under the same standard terms as adults, unless a parent or guardian asks me not to. The terms are set out in the booking paperwork. A parent or guardian can opt out at any time — before, during or after the shoot — and I remove the images as described above. I never publish a child's full name, school or home location alongside their image.

A parent or guardian can exercise any of the rights in this notice on a child's behalf.

Who I share information with

I do not sell personal information, and I do not share it with anyone for their own marketing. I use a small number of providers to run the business. They act on my instructions under written terms that require them to protect your information and use it only for the service they provide to me.

Provider

What they do for me

Squarespace

Hosts this website, the newsletter sign-up, the online shop and website analytics

Microsoft 365

Email, calendar, documents, and the spreadsheet I use for bookings and invoices

Adobe Lightroom

Image editing. Some AI-assisted editing features process images on Adobe's servers

Pic-Time

Online client galleries, downloads and print ordering

Studio Ninja (planned)

Bookings, contracts and invoicing

Loxley Colour

Printing and album production — receives the images ordered and the delivery name and address

Google (if enabled)

Website analytics and advertising measurement, only if you accept these cookies in the banner

AI-assisted tools

I may use AI tools to help with editing and administrative writing. Where personal information is involved, the provider acts as my processor under its business terms

I may also share information with:

• The client who commissioned the work — if you appear in images commissioned by someone else (a family member, an estate, a brand), the client receives the images

• A second photographer, assistant or editor — if I use one for your job, under confidentiality obligations and only with the information they need

• Professional advisers — my accountant, insurer or solicitor, where needed

• HMRC, courts, the police or regulators — where the law requires it or to establish, exercise or defend legal rights

Transfers outside the UK

Some of the providers above store or process information outside the UK, mainly in the United States. UK law allows this where the destination has been found to offer adequate protection — which includes the EU, Israel and, for certified US companies, the UK–US Data Bridge — or where my contract with the provider includes the UK International Data Transfer Agreement or Addendum. I only use providers whose terms give one of these safeguards. Details are available on request.

How long I keep information

What

How long

Why

Photographs — raw files and edited images

Kept indefinitely as my professional archive

I own the copyright, clients re-order years later, and the archive is my body of work. You can ask me to delete images of you — see Your rights

Images used in my portfolio

Until you ask me to remove them, or I retire them

Promotion of my work

Booking paperwork, contracts, invoices, payment records and related correspondence

6 years after the end of the tax year in which the work was completed, then deleted in a single annual clear-out

HMRC record-keeping, and the time limit for contract claims

Enquiries that do not become bookings

2 years after our last contact, deleted in the same annual clear-out

So I can pick the conversation up if you come back

Newsletter subscribers

Until you unsubscribe

Consent-based

Website analytics

Aggregated statistics, kept according to the provider's standard settings

Improving the site

Requests to delete images are handled under Your rights below.

Security

I take appropriate steps to keep information secure, including password protection, limited access and backups. Client galleries are shared through private links.

No system is completely secure. If a breach put you at risk, I would tell you and the regulator as the law requires.

Cookies and website analytics

This website is built on Squarespace, which places a small number of cookies on your device.

• Essential cookies keep the site working — security, remembering your cookie choices and the contents of the shopping basket. These do not need your consent.

• Analytics cookies (Squarespace Analytics) tell me, in aggregate, how people find and use the site: pages viewed, rough location and device type. I use this only to improve the site. You can decline these in the cookie banner at any time.

• Google Analytics and Google Ads tags are not currently used. If I add them, they will run only if you accept them in the cookie banner, and I will update this section.

• Embedded content — the site currently embeds no third-party content. If I embed Instagram, YouTube or Vimeo content in future, those services may set their own cookies when you interact with it.

You can also block or delete cookies in your browser settings, though some parts of the site may not work properly without the essential ones.

Marketing emails

I send newsletters and occasional marketing emails only to people who have signed up through this website or asked to hear from me, and to existing clients about similar work — in which case you were given the chance to opt out when you booked. Every email includes an unsubscribe link, or you can email me and I will remove you. I never pass your details to anyone else for marketing. Sign-up details are stored by Squarespace; if I adopt a separate email tool in future, I will name it here.

Your rights

Under UK data protection law you can:

• Access — ask for a copy of the personal information I hold about you

• Correct — have inaccurate information put right

• Delete — ask me to erase information, including photographs, where there is no overriding reason to keep it

• Restrict — ask me to pause using information while a query is resolved

• Object — to any use based on legitimate interests, including portfolio and social media use, and to direct marketing, which I will always stop

• Portability — receive information you gave me in a reusable electronic format

• Withdraw consent — at any time where I rely on consent, without affecting what was done before

To use any of these, email info@patricknewnham.com. I will respond within one month, or tell you if a complex request needs longer. I may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or excessive.

Where you ask me to delete or stop using images of you, I consider each request on its facts. Images commissioned by someone else — a family member, your employer, an estate — may need to be kept for that client, and I may have legitimate grounds to keep images in my archive even where I stop using them publicly.

Complaints

If you are unhappy with how I have handled your information, please tell me first. Email info@patricknewnham.com with "data protection complaint" in the subject line. I will acknowledge your complaint within 30 days, look into it, and reply without undue delay with what I have found and what I will do about it.

You also have the right to complain to the UK regulator, the Information Commission (formerly the Information Commissioner's Office), at ico.org.uk.

Other things you should know

I do not use automated decision-making or profiling.

This notice applies to patricknewnham.com and the photography I carry out under my own name. I may update it from time to time; the current version is always the one on this page, with the date at the top.